initial

1 files changed, 324 insertions, 0 deletions

diff --git a/other/burneye2/morph.c b/other/burneye2/morph.c
new file mode 100644
index 0000000..3fcc71c
--- /dev/null
+++ b/other/burneye2/morph.c
@@ -0,0 +1,324 @@
+/* morph.c - burneye code morphing functionality
+ *
+ * by scut
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+
+#include <common.h>
+#include <ia32-decode.h>
+#include <ia32-function.h>
+#include <morph.h>
+
+
+/*** static prototypes
+ */
+
+static void
+morph_br_fix_front (morph *mr, ia32_function *func, ia32_bblock *br);
+
+static void
+morph_br_fix_inst (ia32_function *func, ia32_bblock *br, int endbr_num);
+
+static int
+morph_func_sort_2 (void *e1, void *e2);
+
+static int
+morph_br_sort_2 (void *e1, void *e2);
+
+
+/*** implementation
+ */
+
+unsigned int
+morph_abstract (morph *mr)
+{
+        unsigned int    n;
+        unsigned int    newsize,
+                        allsize = 0;
+        unsigned char * newdata;
+
+
+        for (n = 0 ; n < mr->flist_count ; ++n) {
+                newsize = mr->flist[n]->end - mr->flist[n]->start;
+
+                newdata = xcalloc (1, newsize);
+                memcpy (newdata, mr->flist[n]->mem, newsize);
+                mr->flist[n]->mem = newdata;
+
+                allsize += newsize;
+        }
+
+        return (allsize);
+}
+
+
+void
+morph_br_extend (morph *mr, int len)
+{
+        unsigned int    n,      /* temporary index */
+                        bn,     /* bblock index into bblock array (pivot) */
+                        fn;     /* function index into array (pivot) */
+        ia32_function * func;   /* function that contains the morphed bblock */
+        ia32_bblock **  brl;    /* bblock list of function, brl_count items */
+        unsigned int    brl_count;
+
+
+        if (len == 0)
+                return;
+
+        morph_func_sort (mr);
+        assert (mr->flist_count < 2 || mr->flist[0]->start <= mr->flist[1]->start);
+
+        for (fn = 0 ; fn < mr->flist_count &&
+                ia32_trace_range (mr->flist[fn]->start, mr->flist[fn]->end,
+                mr->bblock->start) == 0 ; ++fn)
+                ;
+        assert (fn < mr->flist_count);
+
+        /* now we have located the function the bblock-extension is occuring
+         * in, lets get all bblockes and find the modified one
+         */
+        func = mr->flist[fn];
+        brl = ia32_br_get_all (func->br_root, &brl_count);
+        morph_br_sort (brl, brl_count);
+
+        for (bn = 0 ; bn < brl_count && ia32_trace_range (brl[bn]->start,
+                brl[bn]->end, mr->bblock->start) == 0 ; ++bn)
+                ;
+        assert (bn < brl_count);
+
+        /* extend current bblock, zero extended space and then move all
+         * bblockes that come after it
+         */
+        if (len > 0)
+                func->mem = xrealloc (func->mem,
+                        func->end - func->start + len);
+
+        memmove (&func->mem[mr->bblock->end - func->start + len],
+                &func->mem[mr->bblock->end - func->start],
+                func->end - mr->bblock->end);
+
+        if (len > 0)
+                memset (&func->mem[mr->bblock->end - func->start],
+                        0x90, len);
+
+
+        mr->bblock->end += len;
+        assert (mr->bblock->start < mr->bblock->end);
+        mr->bblock->last_unused = len;
+
+        for (n = bn + 1 ; n < brl_count ; ++n) {
+                brl[n]->start += len;
+                brl[n]->end += len;
+        }
+
+        /* the bblockes are relocated for now, but still dangle by instruction.
+         * first move all following functions, then fixup first the bblockes,
+         * then all functions.
+         */
+        for (n = fn + 1 ; n < mr->flist_count ; ++n) {
+                mr->flist[n]->start += len;
+                mr->flist[n]->end += len;
+        }
+
+        morph_br_fix (mr, func);
+/*FIXME morph_func_fix (mr); */
+
+        free (brl);
+
+        return;
+}
+
+
+void
+morph_br_fix (morph *mr, ia32_function *func)
+{
+        unsigned int    n,
+                        bn;
+        ia32_bblock **  brl;    /* bblock list of function, brl_count items */
+        unsigned int    brl_count;
+
+
+        brl = ia32_br_get_all (func->br_root, &brl_count);
+        morph_br_sort (brl, brl_count);
+
+        for (bn = 0 ; bn < brl_count && ia32_trace_range (brl[bn]->start,
+                brl[bn]->end, mr->bblock->start) == 0 ; ++bn)
+                ;
+        assert (bn < brl_count);
+
+        for (n = 0 ; n < brl_count ; ++n) {
+                if (n == bn && brl[bn]->last_unused < 0) {
+                        fprintf (stderr, "cannot fix last instruction, negative dangling\n");
+                        continue;
+                }
+
+                morph_br_fix_front (mr, func, brl[n]);
+        }
+}
+
+
+static void
+morph_br_fix_front (morph *mr, ia32_function *func, ia32_bblock *br)
+{
+        switch (br->endtype) {
+        case (BR_END_IF):
+                morph_br_fix_inst (func, br, 1);
+                break;
+
+        case (BR_END_TRANSFER):
+                morph_br_fix_inst (func, br, 0);
+                break;
+
+        /* cases we can safely ignore
+         * BR_END_IF_INTER we can ignore because the control flow change
+         *   happens to another function, not at bblock level
+         */
+        case (BR_END_RET):
+        case (BR_END_PASS):
+        case (BR_END_CALL):
+        case (BR_END_FUNCPTR_CALL):
+        case (BR_END_FUNCPTR_JUMP):
+        case (BR_END_IF_INTER):
+        case (BR_END_TRANSFER_INTER):
+        case (BR_END_UNPREDICT):
+        case (BR_END_CTRL_SYSCALL):
+        case (BR_END_CTRL_SYSCALL_END):
+        default:
+                break;
+        }
+}
+
+
+static void
+morph_br_fix_inst (ia32_function *func, ia32_bblock *br, int endbr_num)
+{
+        unsigned char *         dest;
+        unsigned int            vaddr_inst;
+        unsigned int            daddr_current,
+                                daddr_correct;
+        ia32_instruction *      inst,
+                                inst_s;
+        unsigned int            displ_relofs,
+                                displ_size;
+        int                     displ_new;
+
+
+        vaddr_inst = br->end - br->last_unused - br->last_ilen;
+        dest = &func->mem[vaddr_inst - func->start];
+        inst = ia32_decode_instruction (dest, &inst_s);
+        assert (inst != NULL);
+
+        daddr_current = ia32_trace_control (inst, dest, vaddr_inst, NULL,
+                NULL);
+        daddr_correct = br->endbr[endbr_num]->start;
+
+        if (daddr_current == daddr_correct)
+                return;
+
+        fprintf (stderr, "_fix_inst: instruction at 0x%08x\n"
+                "\tdestaddr current = 0x%08x\n"
+                "\tdestaddr correct = 0x%08x\n"
+                "\tbblock unused    = 0x%08x\n",
+                vaddr_inst, daddr_current, daddr_correct, br->last_unused);
+
+        /* get the position and size of the displacement, then adjust it
+         * in-place
+         */
+        displ_relofs = ia32_has_displacement (inst, &displ_size);
+        assert (displ_relofs != 0);
+
+        fprintf (stderr, "\t%d bit displacement at: 0x%08x + %d\n",
+                displ_size, vaddr_inst, displ_relofs);
+
+        displ_new = daddr_correct;
+        displ_new -= vaddr_inst + inst->length;
+        fprintf (stderr, "\told displacement: 0x%08x\n"
+                "\tnew displacement: 0x%08x\n",
+                inst->opc.displ_value, displ_new);
+
+        assert (morph_displ_boundcheck (displ_new, displ_size) == 0);
+        ia32_encode_value (dest + displ_relofs, displ_size, displ_new);
+
+        return;
+}
+
+
+int
+morph_displ_boundcheck (int displ_val, unsigned int displ_size)
+{
+        int     bytes;
+        int     valid_up[] = { 0, 0x7f, 0x7fff, 0, 0x7fffffff };
+        int     valid_down[] = { 0, -0x80, -0x8000, 0, -0x80000000 };
+
+
+        bytes = ia32_bit_to_byte (displ_size);
+
+        if (displ_val > valid_up[bytes])
+                return (1);
+
+        if (displ_val < valid_down[bytes])
+                return (1);
+
+        return (0);
+}
+
+
+void
+morph_func_fix (morph *mr)
+{
+}
+
+
+void
+morph_func_sort (morph *mr)
+{
+        qsort (mr->flist, mr->flist_count, sizeof (mr->flist[0]),
+                (int (*)(const void *,const void*)) morph_func_sort_2);
+}
+
+
+static int
+morph_func_sort_2 (void *e1, void *e2)
+{
+        ia32_function * f1 = *((ia32_function **) e1);
+        ia32_function * f2 = *((ia32_function **) e2);
+
+
+        if (f1->start == f2->start)
+                return (0);
+
+        if (f1->start < f2->start)
+                return (-1);
+
+        return (1);
+}
+
+
+void
+morph_br_sort (ia32_bblock **brlist, unsigned int br_len)
+{
+        qsort (brlist, br_len, sizeof (brlist[0]),
+                (int (*)(const void *, const void *)) morph_br_sort_2);
+}
+
+
+static int
+morph_br_sort_2 (void *e1, void *e2)
+{
+        ia32_bblock *   b1 = *((ia32_bblock **) e1);
+        ia32_bblock *   b2 = *((ia32_bblock **) e2);
+
+
+        if (b1->start == b2->start)
+                return (0);
+
+        if (b1->start < b2->start)
+                return (-1);
+
+        return (1);
+}
+